• An existing, properly implemented, and operating public key infrastructure (PKI) may require an upgrade to a newer Windows version to make use of new features.
• Organizations may need to change or optimize their existing PKI. For example, the certification authority (CA) may have been installed on a domain controller, or incorrect configuration options may have been selected. To change the AD CS implementation so that it follows deployment best practices requires migration. In these cases, upgrading is optional and can be performed after the migration has been completed successfully.
• Microsoft defines and publishes a support lifecycle for each of its products. We recommend upgrading to a newer product before the support lifecycle of a product has ended. For example, CAs running on the Microsoft Windows 2000 Server operating system should be upgraded to Windows Server® 2003 to be supported and can then be upgraded to Windows Server 2008.
• Company mergers and reorganizations are a challenge for information technology (IT) departments and can be especially challenging for the PKI deployment. A PKI can be affected if organizational changes require naming changes or consolidation, or when encrypted information must be transferred to a new owner and encryption certificates be made available to the new owner.

The choice between whether to upgrade or migrate AD CS environment depends on the features and role services that needs to be implemented and the current and desired network environment. The following flow chart will help in selecting the appropriate options and strategies.

In this blog I will demonstrate how to migrate a Windows 2003 based Enterprise CA to Windows 2008 R2 based CA with same PKI name and hostname.

Decommissioning Windows 2003 CA

Installing Windows 2008 R2 Enterprise CA

Restoring CA Backup on Windows 2008 R2 CA

Reissue the templates

Symptoms : -

When you install Forefront Protection for Exchange on Exchange 2010 HUB Server, after the installation Microsoft Exchange Transport Service stops and when you open forefront console, the console cannot be loaded.

Reason: -

If the service WinHTTP Web Proxy Auto-Discovery Service is not running during the installation, Forefront Protection for Exchange does not get installed successfully.

Workaround : -

Uninstall Forefront Protection for Exchange, start all Exchange services, make sure that the service “WinHTTP Web Proxy Auto-Discovery Service” is not disabled and the service is running. Now install Forefront Protection for Exchange.

Windows 7 and Windows Server 2008 R2 SP 1 RC is released, to start evaluating the SP 1 RC check the following URL

https://www.microsoft.com/windowsserver2008/en/us/sp1.aspx

Make sure that the patch discussed at https://support.microsoft.com/kb/944043 is installed on the target XP computer and start the migration of computer again.

Cheers .....